Remote Security, Risk & Compliance Leader

Embrace Software Inc.; United States; Remote; USD 180,000 - 280,000; Full time

Benefits offered by this job

Remote work

Career advancement opportunities

Competitive salary

Job summary

Embrace Software Inc. is seeking a Senior Lead – Security, Risk & Compliance to establish and manage a centralized security framework across portfolio companies.

You will drive SOC 2 engagements, ISO 27001, and compliance with HIPAA, FERPA, and other regulatory requirements while hands‑on implementing security controls with Security, CloudOps, and Engineering teams. The role emphasizes governance, risk management, vulnerability assessments, and mature security services for a distributed, remote

Qualifications

• 10+ years of experience in cybersecurity, risk management, and compliance, including end‑to‑end ownership of SOC 2 Type II or ISO 27001 certification.
• Proven experience developing and implementing security policies, control frameworks, risk assessments, audit evidence, and remediation plans, using platforms such as Drata or Vanta.
• Strong hands‑on experience with cloud and application security across AWS and/or Azure, including IAM, encryption, API security, secure development practices, and vulnerability management.
• Practical experience implementing and managing security technologies such as Cloudflare/WAF, firewalls, vulnerability scanners, SIEM, endpoint security, and monitoring tools.
• Experience conducting technical security assessments, identifying vulnerabilities, implementing security controls, and validating remediation with Engineering and CloudOps teams.
• Experience managing vendor risk, security audits, and customer security reviews, preferably within education, government, legal, or other regulated SaaS environments.
• Strong technical leadership, communication, and mentoring skills, with the ability to work independently and collaborate across multiple portfolio companies and distributed teams.
• Nice to Have: AI security governance familiarity, GDPR knowledge, FinTech security experience, FedRAMP/StateRAMP knowledge, CISSP/CISM/CISA/CCSP are a plus.

Responsibilities

• Develop, implement, and maintain a centralized security control framework across portfolio companies.
• Lead SOC 2 Type I and II engagements end to end, including readiness, control implementation, evidence collection, auditor coordination, and reporting.
• Lead ISO 27001 implementation and certification activities, including ISMS scoping and management reviews.
• Manage government, healthcare, education, and legal-sector security requirements (HIPAA, FERPA, HECVAT, GovRAMP/StateRAMP, NIST 800-53).
• Conduct security risk assessments, maintain risk registers, track remediation, and elevate material risks for leadership.
• Manage vulnerability assessments, penetration testing, remediation prioritization, and security findings tracking.
• Conduct third‑party/vendor security assessments, including sub-processors and AI vendors.
• Develop and maintain business continuity, disaster recovery, security awareness, and secure development standards.
• Manage customer security reviews, questionnaires, and external auditor interactions.
• Establish and improve security processes, reporting, and controls across the portfolio.

Skills

Cybersecurity

Risk management

Compliance

SOC 2

ISO 27001

Cloud security

IAM

Encryption

Vulnerability management

Vendor risk

Tools

Cloudflare/WAF

SIEM

Auditing tools (Drata/Vanta)

Security monitoring platforms

Job description

Embrace Software Inc. is seeking a Senior Lead – Security, Risk & Compliance to establish and manage a centralized security framework across portfolio companies.

You will drive SOC 2 engagements, ISO 27001, and compliance with HIPAA, FERPA, and other regulatory requirements while hands‑on implementing security controls with Security, CloudOps, and Engineering teams. The role emphasizes governance, risk management, vulnerability assessments, and mature security services for a distributed, remote